zeusmuseum. - Ice IX

Ice IX

2143 samples
"Ice IX" was advertised on the opensc.ws forum in August 2011 by user "nvidiag". [44]
"To date, developers of popular Trojans like Zeus’ Slavik, SpyEye’s Gribodemon, and Ice IX’s GSS have never been arrested..." [48]
"During that month, October 2011, he purchased the ICE-IX botnet from an individual using chat handle zebra7753@secure-jabber.biz and the nickname ICE9." [439]
"John Doe 2 goes by the aliases “zebra7753,” “lexa_mef,” “gss,” and “iceIX” and may be contacted at Jabber messaging address iceix@secure-jabber.biz and ICQ messaging address “610875708.”[444]
Based on the Ice IX version 1.2.7.0 reference sample deep dive:
- 576 functions
- 237 encrypted strings
- The C2 is stored in an encrypted BaseConfig using XOR
- Uses "bn1" and "sk1" POST data names
- The DynamicConfig is encrypted using a custom RC4 and "visual decrypt"
- 26 commands

References (31)

2009-02-09: Introducing: abuse.ch ZeuS Tracker BETA [108]
2010-11-05: Two suspected ZBot mules arrested in Wisconsin [471]
2011-08-06: Ice - IX botnet [443]
2011-08-24: Hybrid Hydras and Green Stealing Machines [341]
2011-08-24: Ice IX, the first crimeware based on the leaked ZeuS sources [57]
2011-08-25: Ice IX Bot [318]
2011-08-25: Ice IX – Or Just ZeuS? [44]
2011-08-25: Ice – IX, the Zeus banking trojan succesor ? [209]
2011-08-28: Meet Ice IX, Son Of ZeuS [385]
2011-09-14: Ice IX: not cool at all [115]
2011-09-30: Zeus Trojan Update - new variants based on leaked zeus source code [194]
2011-10-20: New IceIx (Zeus variant) changes its encryption method (again) [193]
2011-11-06: Zeus Code Update Part 2 – Who is behind the recent changes? [159]
2012-02-01: Malware Redirects Bank Phone Calls to Attackers [359]
2012-02-13: SpyEye being kicked to the curb by its customers? [379]
2012-03-24: Zeus Legal Notice [444]
2012-03-25: Microsoft and Financial Services Industry Leaders Target Cybercriminal Operations from Zeus Botnets [122]
2012-03-28: Thoughts on the Microsoft’s “Operation b71” (Zeus botnet civil legal action) [470]
2012-04-12: Critical analysis of Microsoft Operation B71 [302]
2012-07-02: HURRY! CITADEL IS GOING OFF THE OPEN MARKET! [48]
2012-08-01: Inside the ICE IX bot, descendent of Zeus [257]
2012-11-15: Darkode Repository: ICE9 Builder 1.2.6 [481]
2013-01-21: IceIX/Zeus Red/Zeus [419]
2013-09-01: Zeus-R-uS [315]
2013-11-11: Ice 419 [371]
2013-12-01: Analysis of Ice IX [306]
2014-01-02: Thomas Kennedy McCormick FBI Interview [381]
2014-03-14: Top Banking Botnets of 2013 [237]
2014-12-05: ZeuS meets VM [329]
2016-03-02: Hamza Bendelladj Sentencing Memorandum [439]
2019-12-18: win.ice_ix [22]

Version	Count	ITW	IOCs	Reference Sample
1.0.5.0	18	2011-08-11	Samples	4fdaee1072210091799af73f630e0eb993a1d2d42005dc096d1422d9924f1ad5 (VT MB)
1.1.0.0	54	2011-09-24	Samples	4bbbd985c466704a96ff939f0b3f42efd162adaefa1ae9025e43fbc2ce254101 (VT MB)
1.1.5.0	73	2011-10-14	Samples	70e1d2fba60a7d20e531b09ff328fef21b82bb7e87d78a48f964d82c7dd2680f (VT MB)
1.1.6.0	14	2011-10-12	Samples	e4f0a9d751979779844dbfa667cf901b1d297f986201870d365fadb3eea3d451 (VT MB)
1.1.7.0	73	2011-10-28	Samples	a3725e98e15a959f04ed86484d7f6ba845a6f194b855e742590b464adef0c780 (VT MB)
1.1.8.0	14	2011-11-03	Samples	d566befed8d8a4c3450621ca3671e9184a1deb8dc45995a569a2c571d929f032 (VT MB)
1.1.9.0	119	2011-11-14	Samples	476a2cba7810fec1e2036c840308d603fce4b69c3b4fbb7d6938f89346a6adfd (VT MB)
1.1.9.2	33	2011-11-23	Samples	460daa0c566c507d0e566e66d87636eeb495666380eae6210db0c9902ddefcb4 (VT MB)
1.2.0.0	67	2011-11-29	Samples	fa4bd653c43c8c9ce265eba2bd425962752b062fea81327d3cd5338b545d611e (VT MB)
1.2.1.0	29	2011-11-29	Samples	94c9336a6e056520105481a9082e7e84c8a98a794a06b037c573bd9efc9df809 (VT MB)
1.2.2.0	164	2011-12-31	Samples	163fbd87c9a947ce59016e42a9e768ef2e801d0a2785ec48fb9b301d884cf759 (VT MB)
1.2.2.3	1	2018-04-07	Samples	13fc782399baf36e770245323f843a4ac8232cd8a683709ef6e992ec229caf07 (VT MB)
1.2.5.0	661	2012-01-05	Samples	6e57b3151e696198fa799ccdc91d05ecee2462f5adc2ec5cd591b745165106e8 (VT MB)
1.2.5.3	1	2012-02-21	Samples	7fe7bb068cc39ae8bdb2b379324f4e58814b5aa5f0bb15c38ccc504abf05a7ec (VT MB)
1.2.6.0	650	2012-01-23	Samples	ff6353b97df24c70f01f79c12c29d597c8fdf84675fa4ccae6994c5e8e9798cf (VT MB)
1.2.6.3	2	2012-04-11	Samples	05bd182048dcc2fa83657555055a1240a52683f740e515b0d839a594ee50dd65 (VT MB)
1.2.6.4	10	2012-03-22	Samples	6d8f99b5f17d74011562db2b88a2d6feb86bc7e697d5735f1feb1838ecaaaf96 (VT MB)
1.2.7.0	160	2012-04-05	Samples	d122c989fe69f0912e7fb2aa838d6eb83995c86b6986f7b9e20fbea287e91ed4 (VT MB)

curator@zeusmuseum.com / @tildedennis